Introduction

The cyber espionage landscape in South Asia has shifted dramatically with the emergence of a previously undocumented remote access trojan called PapRAT, deployed by the suspected South Asian threat actor group known as Bitter. First detailed by Fortinet FortiGuard Labs in November 2026, this sophisticated malware campaign demonstrates how established advanced persistent threat groups continue to refine their arsenals with increasingly versatile and evasive tools.

Bitter, also tracked as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397, has been active since at least 2013. The group has a well-documented history of targeting government, energy, and engineering organizations across South Asia. With PapRAT, Bitter has expanded its operational capabilities significantly, employing three distinct infection chains that exploit trusted Windows utilities and social engineering techniques to compromise targets.

Understanding the PapRAT Backdoor

PapRAT represents a new generation of remote access trojan designed specifically for long-term persistence and intelligence gathering. What sets it apart from earlier Bitter tooling is its dual-language implementation, existing in both C++ and Rust variants, each offering distinct operational advantages.

Core Capabilities

The PapRAT backdoor supports a comprehensive command set that grants operators full control over compromised systems:

• MSG — enables remote shell access for arbitrary command execution
• FDD — performs directory listing to map the file system structure
• DEL — deletes specified files to cover tracks or destroy evidence
• RUN — executes arbitrary files on the infected host
• GDR — enumerates available drives to identify connected storage media
• SS1 — captures screenshots and transmits them to the command-and-control server
• UPP — uploads local files from the victim machine to attacker infrastructure
• DWW — downloads additional payloads and tools from the C2 server

The Rust variant extends these capabilities further with MS2 for PowerShell command execution, SLP for sleeping and polling resumption, and BYE for process termination. This addition of PowerShell execution capability is particularly significant, as it allows attackers to leverage legitimate Windows administrative tools for post-exploitation activities while evading traditional signature-based detection.

Three Distinct Infection Chains

FortiGuard Labs identified three separate attack vectors used to deploy PapRAT, each tailored to different target profiles and delivery scenarios.

Chain One: LNK and FTP-Based Living Off the Land

The first infection chain employs a living-off-the-land approach that abuses native Windows utilities rather than deploying custom malware binaries immediately. Attackers use a Windows Shortcut (LNK) file that exploits the built-in ftp.exe utility to execute scripts and create scheduled tasks. These scheduled tasks maintain persistent contact with a command-and-control server hosted at goodnfortunes[.]com, allowing the threat actors to retrieve further instructions and collect reconnaissance data.

This chain gathers directory listings from the Desktop, Documents, and Downloads folders, installed antivirus product information, and mounted drive details. Notably, FortiGuard Labs did not find a documented PapRAT deployment in this chain, suggesting it may serve as an initial reconnaissance phase or staging mechanism for subsequent attacks.

Chain Two: VHDX Disk Image with MSI Deployment

The second chain uses a VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet while simultaneously running an MSI installer in the background. The Excel file serves as a decoy to keep the victim engaged, while the MSI installer silently deploys PapRAT onto the system. Lure documents observed in this campaign referenced diplomatic topics including a bilateral meeting request and an ambassador’s letter about the 11th Belt and Road Summit.

This technique is particularly effective because VHDX files are legitimate Windows disk image formats that may bypass certain security filters. The dual-action approach of presenting a decoy document while executing malware in the background is a hallmark of sophisticated APT operations.

Chain Three: URL Shortcut via WebDAV

The third infection chain combines elements from the first two sequences. It begins with an archived file named Official Invitation Majilis 2026 Gala Dinner.rar, which contains a URL shortcut file. This URL file connects to a WebDAV server that fetches a LNK file, which in turn downloads an MSI installer via curl. The MSI installer deploys PapRAT, which then uses its DWW command to download a secondary payload called vnces.exe — identified as WmRAT, a C++ remote access trojan previously associated with Bitter operations.

The use of WebDAV for payload delivery is noteworthy because it leverages legitimate web protocols that are often permitted through corporate firewalls. The combination of URL shortcuts, WebDAV, and scheduled tasks creates a multi-stage attack pipeline that is difficult to detect with conventional endpoint security solutions.

Command and Control Infrastructure

PapRAT communicates with its C2 servers using HTTP requests that include an OTP (one-time password) code and a ClientID composed of the victim’s username and computer name. This authentication mechanism ensures that only legitimate infected endpoints can communicate with the C2 panel, making it harder for security researchers to impersonate victims and gather intelligence on attacker operations.

The primary C2 server identified in the campaign was hosted at rivingtonclarks[.]com, with additional domains including chestergreenfarming[.]com and rappellingaart[.]com. FortiGuard Labs noted that an earlier PapRAT variant shared the same C2 panel design but greeted operators with a Banana Login page — an early indicator of the fruit-word naming convention that runs throughout the entire tool family.

Implications for Enterprise Security

The PapRAT campaign highlights several critical security challenges facing organizations in South Asia and beyond:

• Trusted utility abuse — Bitter’s reliance on native Windows tools like ftp.exe, scheduled tasks, and PowerShell makes detection significantly harder for signature-based security solutions
• Multi-vector delivery — The use of three distinct infection chains means defenders must protect against multiple attack surfaces simultaneously
• Diplomatic social engineering — Lure documents exploiting diplomatic and geopolitical themes are highly effective against government and NGO targets
• Cross-language malware development — The dual C++ and Rust implementations demonstrate investment in operational resilience and detection evasion
• Supply chain potential — The WebDAV-based delivery mechanism could potentially be adapted for broader supply chain attacks

Defensive Recommendations

Organizations should implement a multi-layered defense strategy to counter threats like PapRAT:

• Monitor scheduled tasks — Regularly audit Windows Task Scheduler for unauthorized entries, especially those referencing remote URLs or external scripts
• Restrict LNK and URL file execution — Implement policies that block or quarantine unexpected shortcut files received via email or downloaded from external sources
• Application whitelisting — Use tools like Windows Defender Application Control to prevent unauthorized execution of MSI packages and scripts
• Network segmentation — Segment sensitive systems and monitor outbound WebDAV and FTP traffic for anomalous connections
• Endpoint detection and response — Deploy EDR solutions capable of detecting living-off-the-land techniques and unusual process execution chains
• Email security — Implement advanced email filtering that can identify diplomatic-themed lures and block archive attachments containing shortcut files
• Threat intelligence integration — Subscribe to threat intelligence feeds that track Bitter APT infrastructure and indicators of compromise

The Broader APT Landscape

The PapRAT campaign arrives amid a broader escalation in state-sponsored cyber espionage activities. November 2026 has already seen revelations about Turla’s Cereal malware targeting Microsoft Exchange servers, the SleepyDuck backdoor compromising NPM packages, and the CopperDragon Sparrow framework linking multiple China-nexus espionage campaigns. These developments underscore a trend where APT groups are increasingly investing in modular, evasive toolsets that leverage legitimate infrastructure and protocols.

Bitter’s continued evolution is particularly concerning given the group’s geographic focus on South Asian government and military organizations. The addition of Rust-based malware development suggests the group is investing in modern programming practices to produce more resilient and harder-to-analyze binaries. Rust’s memory safety guarantees also reduce the likelihood of crashes that could alert system administrators to a compromise.

Conclusion

The discovery of PapRAT represents a significant milestone in understanding the evolving capabilities of the Bitter APT group. By combining living-off-the-land techniques with custom Rust-based malware and multi-stage delivery mechanisms, Bitter has created a campaign that is both versatile and difficult to detect. The three infection chains demonstrate a level of operational sophistication that demands equally sophisticated defensive responses.

As APT groups continue to refine their arsenals, organizations must move beyond traditional perimeter defenses and adopt behavioral detection approaches that can identify anomalous use of legitimate tools. The PapRAT campaign serves as a reminder that cyber espionage threats are not static — they evolve continuously, and defensive strategies must evolve with them.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous